|
|
|
|
@@ -62,26 +62,41 @@ You can compose a search query from one or more `key:value` pairs, separated by
|
|
|
|
|
The `key:value` pairs that can be used in a search query are:
|
|
|
|
|
|
|
|
|
|
Key | Value
|
|
|
|
|
--------------:| --------------------------------------------------------
|
|
|
|
|
`actor_id` | ID of the user account that initiated the action
|
|
|
|
|
`actor` | Name of the user account that initiated the action
|
|
|
|
|
`oauth_app_id` | ID of the OAuth application associated with the action
|
|
|
|
|
`action` | Name of the audited action
|
|
|
|
|
`user_id` | ID of the user affected by the action
|
|
|
|
|
`user` | Name of the user affected by the action
|
|
|
|
|
`repo_id` | ID of the repository affected by the action (if applicable)
|
|
|
|
|
`repo` | Name of the repository affected by the action (if applicable)
|
|
|
|
|
`actor_ip` | IP address from which the action was initiated
|
|
|
|
|
`created` | Time at which the action occurred{% ifversion ghes %}. If querying the audit log from the site admin dashboard, use `created_at` instead{% endif %}
|
|
|
|
|
`from` | View from which the action was initiated
|
|
|
|
|
`note` | Miscellaneous event-specific information (in either plain text or JSON format)
|
|
|
|
|
`org` | Name of the organization affected by the action (if applicable)
|
|
|
|
|
`org_id` | ID of the organization affected by the action (if applicable)
|
|
|
|
|
`business` | Name of the enterprise affected by the action (if applicable)
|
|
|
|
|
`business_id` | ID of the enterprise affected by the action (if applicable)
|
|
|
|
|
-------------- | --------------------------------------------------------
|
|
|
|
|
`action` | Name of the audited action.
|
|
|
|
|
`actor` | Name of the user account that initiated the action.
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`actor_id` | ID of the user account that initiated the action.{% endif %}
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`actor_ip` | IP address from which the action was initiated.{% endif %}
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`business` | Name of the enterprise affected by the action (if applicable).{% endif %}
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`business_id` | ID of the enterprise affected by the action (if applicable).{% endif %}
|
|
|
|
|
{%- ifversion token-audit-log %}
|
|
|
|
|
`hashed_token` | The token used to authenticate for the action (if applicable, see "[AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token)")
|
|
|
|
|
{%- endif %}
|
|
|
|
|
`created` | Time at which the action occurred.{% ifversion ghes %} If querying the audit log from the site admin dashboard, use `created_at` instead.{% endif %}
|
|
|
|
|
`country` | Name of the country where the actor was when performing the action.
|
|
|
|
|
`country_code` | Two-letter short code of the country where the actor was when performing the action.
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`from` | View from which the action was initiated.{% endif %}
|
|
|
|
|
`hashed_token` | The token used to authenticate for the action (if applicable, see "[Identifying audit log events performed by an access token](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token)"). {% endif %}
|
|
|
|
|
`ip` | IP address of the actor.
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`note` | Miscellaneous event-specific information (in either plain text or JSON format).{% endif %}
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`oauth_app_id` | ID of the OAuth application associated with the action.{% endif %}
|
|
|
|
|
`operation` | Operation type that corresponds with the action. Operation types are `create`, `access`, `modify`, `remove`, `authentication`, `transfer`, and `restore`.
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`org` | Name of the organization affected by the action (if applicable).{% endif %}
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`org_id` | ID of the organization affected by the action (if applicable).{% endif %}
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`repo_id` | ID of the repository affected by the action (if applicable).{% endif %}
|
|
|
|
|
`repository` | Name with owner of the repository where the action occurred (such as `octocat/octo-repo`).
|
|
|
|
|
{%- ifversion ghes or ghae %}
|
|
|
|
|
`user_id` | ID of the user affected by the action.{% endif %}
|
|
|
|
|
`user` | Name of the user affected by the action.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
To see actions grouped by category, you can also use the action qualifier as a `key:value` pair. For more information, see "[Search based on the action performed](#search-based-on-the-action-performed)."
|
|
|
|
|
|
|
|
|
|
|