Update audit log event data (#57718)
Co-authored-by: Felicity Chapman <felicitymay@github.com>
This commit is contained in:
docs-bot
@@ -220,6 +220,88 @@
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_create",
|
||||
"description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"target_amount",
|
||||
"target_type",
|
||||
"target_id",
|
||||
"alert_enabled",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"pricing_target_type",
|
||||
"pricing_target_id",
|
||||
"budget_limit_type",
|
||||
"alert_recipient_user_ids"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_delete",
|
||||
"description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"uuid",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_update",
|
||||
"description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"target_amount",
|
||||
"target_type",
|
||||
"target_id",
|
||||
"alert_enabled",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header",
|
||||
"old_target_amount",
|
||||
"old_budget_limit_type",
|
||||
"old_alert_enabled",
|
||||
"old_target_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.change_billing_type",
|
||||
"description": "The way the account pays for GitHub was changed.",
|
||||
@@ -260,6 +342,42 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing your payment and billing information"
|
||||
},
|
||||
{
|
||||
"action": "billing_customer.azure_subscription_linked",
|
||||
"description": "Azure subscription has been linked on this account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing_customer.azure_subscription_unlinked",
|
||||
"description": "Azure subscription has been unlinked on this account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.lock",
|
||||
"description": "N/A",
|
||||
@@ -1295,6 +1413,27 @@
|
||||
"scheduled_plan"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "copilot.swe_agent_mcp_config_updated",
|
||||
"description": "MCP Configuration for Copilot coding agent was updated for a specific repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"new_config",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "copilot.swe_agent_repo_disabled",
|
||||
"description": "Specific repositories were disabled from using Copilot coding agent.",
|
||||
@@ -2418,7 +2557,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -2439,7 +2578,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -2461,7 +2600,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -3342,6 +3481,100 @@
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocked_by_add",
|
||||
"description": "An issue was marked as blocked by another issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocked_by_remove",
|
||||
"description": "The blocked by relationship between an issue and another issue was removed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"org",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocking_add",
|
||||
"description": "An issue was marked as blocking another issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocking_remove",
|
||||
"description": "The blocking relationship between an issue and another issue was removed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue.destroy",
|
||||
"description": "An issue was deleted from the repository.",
|
||||
@@ -5052,6 +5285,32 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.code_security_metered_usage_lock",
|
||||
"description": "Enablement for Code Security features on new repositories has been locked for this organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.code_security_metered_usage_unlock",
|
||||
"description": "Enablement for Code Security features on new repositories has been unlocked for this organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.codeql_disabled",
|
||||
"description": "Code scanning using the default setup was disabled for an organization.",
|
||||
@@ -6083,7 +6342,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -6146,7 +6406,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -6842,6 +7103,32 @@
|
||||
],
|
||||
"docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
|
||||
},
|
||||
{
|
||||
"action": "org.secret_protection_metered_usage_lock",
|
||||
"description": "Enablement for Secret Protection features on new repositories has been locked for this organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.secret_protection_metered_usage_unlock",
|
||||
"description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_automatic_validity_checks.disabled",
|
||||
"description": "Automatic partner validation checks have been disabled at the organization level",
|
||||
@@ -7383,49 +7670,36 @@
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"description": "The push protection setting was updated for a secret type for your organization.",
|
||||
"docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"actor",
|
||||
"org_id",
|
||||
"org",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"push_protection_setting",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
"created_at"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"description": "The push protection pattern configuration was updated for your organization.",
|
||||
"docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"actor",
|
||||
"org_id",
|
||||
"org",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
"created_at"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org.security_center_export_code_scanning_metrics",
|
||||
@@ -7587,6 +7861,29 @@
|
||||
],
|
||||
"docs_reference_titles": "Self-hosted runners"
|
||||
},
|
||||
{
|
||||
"action": "org.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for an organization.",
|
||||
"docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
|
||||
},
|
||||
{
|
||||
"action": "org.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
|
||||
@@ -7925,6 +8222,28 @@
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.update_immutable_releases_settings_policy",
|
||||
"description": "The settings policy for immutable releases was updated for an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"old_policy",
|
||||
"new_policy",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.update_integration_secret",
|
||||
"description": "A Codespaces or Dependabot secret was updated for an organization.",
|
||||
@@ -8091,6 +8410,58 @@
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
|
||||
},
|
||||
{
|
||||
"action": "organization_custom_property_value.create",
|
||||
"description": "An organization's custom property value was manually set for the first time.",
|
||||
"docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"definition_id",
|
||||
"property_name",
|
||||
"value",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
|
||||
},
|
||||
{
|
||||
"action": "organization_custom_property_value.destroy",
|
||||
"description": "An organization's custom property value was deleted.",
|
||||
"docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"definition_id",
|
||||
"property_name",
|
||||
"value",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
|
||||
},
|
||||
{
|
||||
"action": "organization_default_label.create",
|
||||
"description": "A default label was created for repositories in an organization.",
|
||||
@@ -11729,6 +12100,56 @@
|
||||
],
|
||||
"docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
|
||||
},
|
||||
{
|
||||
"action": "repo.immutable_releases_settings_disabled",
|
||||
"description": "The setting for immutable releases was disabled for a repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repo.immutable_releases_settings_enabled",
|
||||
"description": "The setting for immutable releases was enabled for a repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repo.pages_cname",
|
||||
"description": "A GitHub Pages custom domain was modified in a repository.",
|
||||
@@ -12245,6 +12666,60 @@
|
||||
],
|
||||
"docs_reference_titles": "Self-hosted runners"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_cache_retention_policy",
|
||||
"description": "The cache retention policy for GitHub Actions was set for a repository.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for a repository.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
|
||||
@@ -15918,6 +16393,102 @@
|
||||
"_document_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.add_member",
|
||||
"description": "A member of an organization was added to a team.",
|
||||
@@ -15937,7 +16508,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -15965,6 +16537,30 @@
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.add_to_organization",
|
||||
"description": "A team was added to an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"team_type",
|
||||
"team",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.change_parent_team",
|
||||
"description": "A child team was created or a child team's parent was changed.",
|
||||
@@ -16003,7 +16599,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -16026,7 +16623,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -16069,7 +16667,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -16220,6 +16819,30 @@
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
|
||||
},
|
||||
{
|
||||
"action": "team.remove_from_organization",
|
||||
"description": "A team was removed from an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"team_type",
|
||||
"team",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.remove_member",
|
||||
"description": "An organization member was removed from a team.",
|
||||
@@ -16240,7 +16863,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -16285,7 +16909,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -16377,6 +17002,30 @@
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "user_content_edit.delete",
|
||||
"description": "Triggered when a user content edit is deleted.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"request_id",
|
||||
"actor",
|
||||
"user_content_id",
|
||||
"user_content_type",
|
||||
"created_at",
|
||||
"user_agent",
|
||||
"deleted_by",
|
||||
"editor_id",
|
||||
"_document_id",
|
||||
"deleted_at",
|
||||
"action",
|
||||
"actor_id",
|
||||
"editor",
|
||||
"deleted_by_id",
|
||||
"deleted_content",
|
||||
"operation_type",
|
||||
"@timestamp"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.create",
|
||||
"description": "A Dependabot rule was created.",
|
||||
|
||||
@@ -143,6 +143,88 @@
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_create",
|
||||
"description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"target_amount",
|
||||
"target_type",
|
||||
"target_id",
|
||||
"alert_enabled",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"pricing_target_type",
|
||||
"pricing_target_id",
|
||||
"budget_limit_type",
|
||||
"alert_recipient_user_ids"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_delete",
|
||||
"description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"uuid",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_update",
|
||||
"description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"target_amount",
|
||||
"target_type",
|
||||
"target_id",
|
||||
"alert_enabled",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header",
|
||||
"old_target_amount",
|
||||
"old_budget_limit_type",
|
||||
"old_alert_enabled",
|
||||
"old_target_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.change_billing_type",
|
||||
"description": "The way the account pays for GitHub was changed.",
|
||||
@@ -183,6 +265,42 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing your payment and billing information"
|
||||
},
|
||||
{
|
||||
"action": "billing_customer.azure_subscription_linked",
|
||||
"description": "Azure subscription has been linked on this account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing_customer.azure_subscription_unlinked",
|
||||
"description": "Azure subscription has been unlinked on this account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.lock",
|
||||
"description": "N/A",
|
||||
@@ -342,6 +460,50 @@
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "business.set_actions_cache_retention_policy",
|
||||
"description": "The cache retention policy for GitHub Actions was set for an enterprise.",
|
||||
"docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"name",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for an enterprise.",
|
||||
"docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"name",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
|
||||
@@ -2345,6 +2507,100 @@
|
||||
],
|
||||
"docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocked_by_add",
|
||||
"description": "An issue was marked as blocked by another issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocked_by_remove",
|
||||
"description": "The blocked by relationship between an issue and another issue was removed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"org",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocking_add",
|
||||
"description": "An issue was marked as blocking another issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocking_remove",
|
||||
"description": "The blocking relationship between an issue and another issue was removed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "marketplace_agreement_signature.create",
|
||||
"description": "The GitHub Marketplace Developer Agreement was signed.",
|
||||
@@ -3375,6 +3631,29 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for an organization.",
|
||||
"docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
|
||||
},
|
||||
{
|
||||
"action": "org.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
|
||||
@@ -5659,6 +5938,60 @@
|
||||
"user_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_cache_retention_policy",
|
||||
"description": "The cache retention policy for GitHub Actions was set for a repository.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for a repository.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
|
||||
@@ -6401,6 +6734,58 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "social_identity.linked",
|
||||
"description": "A user linked a social identity to their account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"user_id",
|
||||
"action",
|
||||
"actor_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "social_identity.unlinked",
|
||||
"description": "A user unlinked a social identity from their account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "social_identity.unlinked_all",
|
||||
"description": "A user unlinked all social identities from their account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"user_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sponsors.agreement_sign",
|
||||
"description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
|
||||
@@ -6839,6 +7224,102 @@
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "successor_invitation.accept",
|
||||
"description": "Triggered when you accept a succession invitation.",
|
||||
|
||||
@@ -352,6 +352,88 @@
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_create",
|
||||
"description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"target_amount",
|
||||
"target_type",
|
||||
"target_id",
|
||||
"alert_enabled",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"pricing_target_type",
|
||||
"pricing_target_id",
|
||||
"budget_limit_type",
|
||||
"alert_recipient_user_ids"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_delete",
|
||||
"description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"uuid",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_update",
|
||||
"description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"target_amount",
|
||||
"target_type",
|
||||
"target_id",
|
||||
"alert_enabled",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header",
|
||||
"old_target_amount",
|
||||
"old_budget_limit_type",
|
||||
"old_alert_enabled",
|
||||
"old_target_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.change_billing_type",
|
||||
"description": "The way the account pays for GitHub was changed.",
|
||||
@@ -392,6 +474,42 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing your payment and billing information"
|
||||
},
|
||||
{
|
||||
"action": "billing_customer.azure_subscription_linked",
|
||||
"description": "Azure subscription has been linked on this account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing_customer.azure_subscription_unlinked",
|
||||
"description": "Azure subscription has been unlinked on this account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.lock",
|
||||
"description": "N/A",
|
||||
@@ -693,6 +811,25 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.advanced_security_metered_usage_lock",
|
||||
"description": "Enablement for Advanced Security features on new repositories has been locked for this enterprise.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "business.advanced_security_metered_usage_unlock",
|
||||
"description": "Enablement for Advanced Security features on new repositories has been unlocked for this enterprise.",
|
||||
@@ -1096,6 +1233,25 @@
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "business.code_security_metered_usage_unlock",
|
||||
"description": "Enablement for Code Security features on new repositories has been unlocked for this enterprise.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "business.connect_usage_metrics_export",
|
||||
"description": "Server statistics were exported for the enterprise.",
|
||||
@@ -2088,6 +2244,44 @@
|
||||
"business"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "business.secret_protection_metered_usage_lock",
|
||||
"description": "Enablement for Secret Protection features on new repositories has been locked for this enterprise.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "business.secret_protection_metered_usage_unlock",
|
||||
"description": "Enablement for Secret Protection features on new repositories has been unlocked for this enterprise.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_automatic_validity_checks.disabled",
|
||||
"description": "Automatic partner validation checks have been disabled at the business level",
|
||||
@@ -2576,24 +2770,17 @@
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your enterprise.",
|
||||
"description": "The push protection setting was updated for a secret type for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"actor",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"push_protection_setting",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
"created_at"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
@@ -2602,17 +2789,11 @@
|
||||
"description": "The push protection pattern configuration was updated for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"actor",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
"created_at"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
@@ -2740,6 +2921,50 @@
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "business.set_actions_cache_retention_policy",
|
||||
"description": "The cache retention policy for GitHub Actions was set for an enterprise.",
|
||||
"docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"name",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for an enterprise.",
|
||||
"docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"name",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
|
||||
@@ -6074,7 +6299,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -6095,7 +6320,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -6117,7 +6342,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -9584,7 +9809,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -9647,7 +9873,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -10819,49 +11046,36 @@
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"description": "The push protection setting was updated for a secret type for your organization.",
|
||||
"docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"actor",
|
||||
"org_id",
|
||||
"org",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"push_protection_setting",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
"created_at"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"description": "The push protection pattern configuration was updated for your organization.",
|
||||
"docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"actor",
|
||||
"org_id",
|
||||
"org",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
"created_at"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org.self_hosted_runner_offline",
|
||||
@@ -10912,6 +11126,29 @@
|
||||
],
|
||||
"docs_reference_titles": "Self-hosted runners"
|
||||
},
|
||||
{
|
||||
"action": "org.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for an organization.",
|
||||
"docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
|
||||
},
|
||||
{
|
||||
"action": "org.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
|
||||
@@ -11232,6 +11469,28 @@
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.update_immutable_releases_settings_policy",
|
||||
"description": "The settings policy for immutable releases was updated for an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"old_policy",
|
||||
"new_policy",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.update_integration_secret",
|
||||
"description": "A Codespaces or Dependabot secret was updated for an organization.",
|
||||
@@ -11378,6 +11637,140 @@
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
|
||||
},
|
||||
{
|
||||
"action": "organization_custom_property_definition.create",
|
||||
"description": "A new organization custom property definition was created.",
|
||||
"docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"definition_id",
|
||||
"property_name",
|
||||
"description",
|
||||
"value_type",
|
||||
"required",
|
||||
"allowed_values",
|
||||
"default_value",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
|
||||
},
|
||||
{
|
||||
"action": "organization_custom_property_definition.destroy",
|
||||
"description": "An organization custom property definition was deleted.",
|
||||
"docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"definition_id",
|
||||
"property_name",
|
||||
"description",
|
||||
"value_type",
|
||||
"required",
|
||||
"allowed_values",
|
||||
"default_value",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
|
||||
},
|
||||
{
|
||||
"action": "organization_custom_property_definition.update",
|
||||
"description": "An organization custom property definition was updated.",
|
||||
"docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"definition_id",
|
||||
"property_name",
|
||||
"old_values_editable_by",
|
||||
"values_editable_by",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"old_allowed_values"
|
||||
],
|
||||
"docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
|
||||
},
|
||||
{
|
||||
"action": "organization_custom_property_value.create",
|
||||
"description": "An organization's custom property value was manually set for the first time.",
|
||||
"docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"definition_id",
|
||||
"property_name",
|
||||
"value",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
|
||||
},
|
||||
{
|
||||
"action": "organization_custom_property_value.destroy",
|
||||
"description": "An organization's custom property value was deleted.",
|
||||
"docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"definition_id",
|
||||
"property_name",
|
||||
"value",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
|
||||
},
|
||||
{
|
||||
"action": "organization_default_label.create",
|
||||
"description": "A default label was created for repositories in an organization.",
|
||||
@@ -15014,6 +15407,56 @@
|
||||
],
|
||||
"docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
|
||||
},
|
||||
{
|
||||
"action": "repo.immutable_releases_settings_disabled",
|
||||
"description": "The setting for immutable releases was disabled for a repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repo.immutable_releases_settings_enabled",
|
||||
"description": "The setting for immutable releases was enabled for a repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repo.pages_cname",
|
||||
"description": "A GitHub Pages custom domain was modified in a repository.",
|
||||
@@ -15530,6 +15973,60 @@
|
||||
],
|
||||
"docs_reference_titles": "Self-hosted runners"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_cache_retention_policy",
|
||||
"description": "The cache retention policy for GitHub Actions was set for a repository.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for a repository.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
|
||||
@@ -19202,7 +19699,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -19230,6 +19728,30 @@
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.add_to_organization",
|
||||
"description": "A team was added to an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"team_type",
|
||||
"team",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.change_parent_team",
|
||||
"description": "A child team was created or a child team's parent was changed.",
|
||||
@@ -19268,7 +19790,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -19291,7 +19814,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -19334,7 +19858,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -19422,6 +19947,30 @@
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
|
||||
},
|
||||
{
|
||||
"action": "team.remove_from_organization",
|
||||
"description": "A team was removed from an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"team_type",
|
||||
"team",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.remove_member",
|
||||
"description": "An organization member was removed from a team.",
|
||||
@@ -19442,7 +19991,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -19487,7 +20037,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -19579,6 +20130,30 @@
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "user_content_edit.delete",
|
||||
"description": "Triggered when a user content edit is deleted.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"request_id",
|
||||
"actor",
|
||||
"user_content_id",
|
||||
"user_content_type",
|
||||
"created_at",
|
||||
"user_agent",
|
||||
"deleted_by",
|
||||
"editor_id",
|
||||
"_document_id",
|
||||
"deleted_at",
|
||||
"action",
|
||||
"actor_id",
|
||||
"editor",
|
||||
"deleted_by_id",
|
||||
"deleted_content",
|
||||
"operation_type",
|
||||
"@timestamp"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "user_email.confirm_claim",
|
||||
"description": "An enterprise managed user claimed an email address.",
|
||||
|
||||
@@ -220,6 +220,88 @@
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_create",
|
||||
"description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"target_amount",
|
||||
"target_type",
|
||||
"target_id",
|
||||
"alert_enabled",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"pricing_target_type",
|
||||
"pricing_target_id",
|
||||
"budget_limit_type",
|
||||
"alert_recipient_user_ids"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_delete",
|
||||
"description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"uuid",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_update",
|
||||
"description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"target_amount",
|
||||
"target_type",
|
||||
"target_id",
|
||||
"alert_enabled",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header",
|
||||
"old_target_amount",
|
||||
"old_budget_limit_type",
|
||||
"old_alert_enabled",
|
||||
"old_target_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.change_billing_type",
|
||||
"description": "The way the account pays for GitHub was changed.",
|
||||
@@ -260,6 +342,42 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing your payment and billing information"
|
||||
},
|
||||
{
|
||||
"action": "billing_customer.azure_subscription_linked",
|
||||
"description": "Azure subscription has been linked on this account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing_customer.azure_subscription_unlinked",
|
||||
"description": "Azure subscription has been unlinked on this account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.lock",
|
||||
"description": "N/A",
|
||||
@@ -1295,6 +1413,27 @@
|
||||
"scheduled_plan"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "copilot.swe_agent_mcp_config_updated",
|
||||
"description": "MCP Configuration for Copilot coding agent was updated for a specific repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"new_config",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "copilot.swe_agent_repo_disabled",
|
||||
"description": "Specific repositories were disabled from using Copilot coding agent.",
|
||||
@@ -2418,7 +2557,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -2439,7 +2578,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -2461,7 +2600,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -3342,6 +3481,100 @@
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocked_by_add",
|
||||
"description": "An issue was marked as blocked by another issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocked_by_remove",
|
||||
"description": "The blocked by relationship between an issue and another issue was removed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"org",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocking_add",
|
||||
"description": "An issue was marked as blocking another issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocking_remove",
|
||||
"description": "The blocking relationship between an issue and another issue was removed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue.destroy",
|
||||
"description": "An issue was deleted from the repository.",
|
||||
@@ -5052,6 +5285,32 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.code_security_metered_usage_lock",
|
||||
"description": "Enablement for Code Security features on new repositories has been locked for this organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.code_security_metered_usage_unlock",
|
||||
"description": "Enablement for Code Security features on new repositories has been unlocked for this organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.codeql_disabled",
|
||||
"description": "Code scanning using the default setup was disabled for an organization.",
|
||||
@@ -6083,7 +6342,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -6146,7 +6406,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -6842,6 +7103,32 @@
|
||||
],
|
||||
"docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
|
||||
},
|
||||
{
|
||||
"action": "org.secret_protection_metered_usage_lock",
|
||||
"description": "Enablement for Secret Protection features on new repositories has been locked for this organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.secret_protection_metered_usage_unlock",
|
||||
"description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_automatic_validity_checks.disabled",
|
||||
"description": "Automatic partner validation checks have been disabled at the organization level",
|
||||
@@ -7383,49 +7670,36 @@
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"description": "The push protection setting was updated for a secret type for your organization.",
|
||||
"docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"actor",
|
||||
"org_id",
|
||||
"org",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"push_protection_setting",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
"created_at"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"description": "The push protection pattern configuration was updated for your organization.",
|
||||
"docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"actor",
|
||||
"org_id",
|
||||
"org",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
"created_at"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org.security_center_export_code_scanning_metrics",
|
||||
@@ -7587,6 +7861,29 @@
|
||||
],
|
||||
"docs_reference_titles": "Self-hosted runners"
|
||||
},
|
||||
{
|
||||
"action": "org.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for an organization.",
|
||||
"docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
|
||||
},
|
||||
{
|
||||
"action": "org.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
|
||||
@@ -7925,6 +8222,28 @@
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.update_immutable_releases_settings_policy",
|
||||
"description": "The settings policy for immutable releases was updated for an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"old_policy",
|
||||
"new_policy",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.update_integration_secret",
|
||||
"description": "A Codespaces or Dependabot secret was updated for an organization.",
|
||||
@@ -8091,6 +8410,58 @@
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
|
||||
},
|
||||
{
|
||||
"action": "organization_custom_property_value.create",
|
||||
"description": "An organization's custom property value was manually set for the first time.",
|
||||
"docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"definition_id",
|
||||
"property_name",
|
||||
"value",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
|
||||
},
|
||||
{
|
||||
"action": "organization_custom_property_value.destroy",
|
||||
"description": "An organization's custom property value was deleted.",
|
||||
"docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"definition_id",
|
||||
"property_name",
|
||||
"value",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
|
||||
},
|
||||
{
|
||||
"action": "organization_default_label.create",
|
||||
"description": "A default label was created for repositories in an organization.",
|
||||
@@ -11729,6 +12100,56 @@
|
||||
],
|
||||
"docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
|
||||
},
|
||||
{
|
||||
"action": "repo.immutable_releases_settings_disabled",
|
||||
"description": "The setting for immutable releases was disabled for a repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repo.immutable_releases_settings_enabled",
|
||||
"description": "The setting for immutable releases was enabled for a repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repo.pages_cname",
|
||||
"description": "A GitHub Pages custom domain was modified in a repository.",
|
||||
@@ -12245,6 +12666,60 @@
|
||||
],
|
||||
"docs_reference_titles": "Self-hosted runners"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_cache_retention_policy",
|
||||
"description": "The cache retention policy for GitHub Actions was set for a repository.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for a repository.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
|
||||
@@ -15918,6 +16393,102 @@
|
||||
"_document_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.add_member",
|
||||
"description": "A member of an organization was added to a team.",
|
||||
@@ -15937,7 +16508,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -15965,6 +16537,30 @@
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.add_to_organization",
|
||||
"description": "A team was added to an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"team_type",
|
||||
"team",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.change_parent_team",
|
||||
"description": "A child team was created or a child team's parent was changed.",
|
||||
@@ -16003,7 +16599,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -16026,7 +16623,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -16069,7 +16667,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -16220,6 +16819,30 @@
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
|
||||
},
|
||||
{
|
||||
"action": "team.remove_from_organization",
|
||||
"description": "A team was removed from an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"team_type",
|
||||
"team",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.remove_member",
|
||||
"description": "An organization member was removed from a team.",
|
||||
@@ -16240,7 +16863,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -16285,7 +16909,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -16377,6 +17002,30 @@
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "user_content_edit.delete",
|
||||
"description": "Triggered when a user content edit is deleted.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"request_id",
|
||||
"actor",
|
||||
"user_content_id",
|
||||
"user_content_type",
|
||||
"created_at",
|
||||
"user_agent",
|
||||
"deleted_by",
|
||||
"editor_id",
|
||||
"_document_id",
|
||||
"deleted_at",
|
||||
"action",
|
||||
"actor_id",
|
||||
"editor",
|
||||
"deleted_by_id",
|
||||
"deleted_content",
|
||||
"operation_type",
|
||||
"@timestamp"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.create",
|
||||
"description": "A Dependabot rule was created.",
|
||||
|
||||
@@ -143,6 +143,88 @@
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_create",
|
||||
"description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"target_amount",
|
||||
"target_type",
|
||||
"target_id",
|
||||
"alert_enabled",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"pricing_target_type",
|
||||
"pricing_target_id",
|
||||
"budget_limit_type",
|
||||
"alert_recipient_user_ids"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_delete",
|
||||
"description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"uuid",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.budget_update",
|
||||
"description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"customer_id",
|
||||
"target_amount",
|
||||
"target_type",
|
||||
"target_id",
|
||||
"alert_enabled",
|
||||
"status",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header",
|
||||
"old_target_amount",
|
||||
"old_budget_limit_type",
|
||||
"old_alert_enabled",
|
||||
"old_target_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.change_billing_type",
|
||||
"description": "The way the account pays for GitHub was changed.",
|
||||
@@ -183,6 +265,42 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing your payment and billing information"
|
||||
},
|
||||
{
|
||||
"action": "billing_customer.azure_subscription_linked",
|
||||
"description": "Azure subscription has been linked on this account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing_customer.azure_subscription_unlinked",
|
||||
"description": "Azure subscription has been unlinked on this account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "billing.lock",
|
||||
"description": "N/A",
|
||||
@@ -342,6 +460,50 @@
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "business.set_actions_cache_retention_policy",
|
||||
"description": "The cache retention policy for GitHub Actions was set for an enterprise.",
|
||||
"docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"name",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for an enterprise.",
|
||||
"docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"name",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
|
||||
@@ -2345,6 +2507,100 @@
|
||||
],
|
||||
"docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocked_by_add",
|
||||
"description": "An issue was marked as blocked by another issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocked_by_remove",
|
||||
"description": "The blocked by relationship between an issue and another issue was removed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"org",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocking_add",
|
||||
"description": "An issue was marked as blocking another issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "issue_dependencies.blocking_remove",
|
||||
"description": "The blocking relationship between an issue and another issue was removed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "marketplace_agreement_signature.create",
|
||||
"description": "The GitHub Marketplace Developer Agreement was signed.",
|
||||
@@ -3375,6 +3631,29 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "org.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for an organization.",
|
||||
"docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
|
||||
},
|
||||
{
|
||||
"action": "org.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
|
||||
@@ -5659,6 +5938,60 @@
|
||||
"user_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_cache_retention_policy",
|
||||
"description": "The cache retention policy for GitHub Actions was set for a repository.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_cache_storage_policy",
|
||||
"description": "The cache storage policy for GitHub Actions was set for a repository.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"visibility",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
|
||||
},
|
||||
{
|
||||
"action": "repo.set_actions_fork_pr_approvals_policy",
|
||||
"description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
|
||||
@@ -6401,6 +6734,58 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "social_identity.linked",
|
||||
"description": "A user linked a social identity to their account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"user_id",
|
||||
"action",
|
||||
"actor_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "social_identity.unlinked",
|
||||
"description": "A user unlinked a social identity from their account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "social_identity.unlinked_all",
|
||||
"description": "A user unlinked all social identities from their account.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"request_access_security_header",
|
||||
"user_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sponsors.agreement_sign",
|
||||
"description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
|
||||
@@ -6839,6 +7224,102 @@
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "successor_invitation.accept",
|
||||
"description": "Triggered when you accept a succession invitation.",
|
||||
|
||||
@@ -1506,48 +1506,6 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.secret_scanning_repo_admin_settings_policy_update",
|
||||
"description": "N/A",
|
||||
@@ -4093,7 +4051,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -4114,7 +4072,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -4136,7 +4094,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -7649,52 +7607,6 @@
|
||||
],
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org.self_hosted_runner_offline",
|
||||
"description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
@@ -13886,7 +13798,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -13952,7 +13865,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -13975,7 +13889,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -14018,7 +13933,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -14126,7 +14042,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -14171,7 +14088,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -2089,7 +2089,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -2110,7 +2110,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -2132,7 +2132,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -5544,7 +5544,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -5607,7 +5608,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -6819,27 +6821,6 @@
|
||||
],
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org.self_hosted_runner_offline",
|
||||
"description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
@@ -14179,7 +14160,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -14245,7 +14227,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -14268,7 +14251,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -14311,7 +14295,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -14482,7 +14467,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -14527,7 +14513,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -1506,48 +1506,6 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.secret_scanning_repo_admin_settings_policy_update",
|
||||
"description": "N/A",
|
||||
@@ -4093,7 +4051,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -4114,7 +4072,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -4136,7 +4094,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -7649,52 +7607,6 @@
|
||||
],
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org.security_center_export_coverage",
|
||||
"description": "A CSV export was requested on the Coverage page.",
|
||||
@@ -13965,6 +13877,102 @@
|
||||
"_document_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "successor_invitation.accept",
|
||||
"description": "Triggered when you accept a succession invitation.",
|
||||
@@ -14085,7 +14093,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -14151,7 +14160,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -14174,7 +14184,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -14217,7 +14228,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -14325,7 +14337,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -14370,7 +14383,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -2096,7 +2096,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -2117,7 +2117,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -2139,7 +2139,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -5570,7 +5570,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -5633,7 +5634,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -6845,27 +6847,6 @@
|
||||
],
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org.security_center_export_coverage",
|
||||
"description": "A CSV export was requested on the Coverage page.",
|
||||
@@ -14716,6 +14697,102 @@
|
||||
"_document_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.add_member",
|
||||
"description": "A member of an organization was added to a team.",
|
||||
@@ -14735,7 +14812,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -14801,7 +14879,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -14824,7 +14903,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -14867,7 +14947,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -15038,7 +15119,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -15083,7 +15165,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -6596,6 +6596,102 @@
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "successor_invitation.accept",
|
||||
"description": "Triggered when you accept a succession invitation.",
|
||||
|
||||
@@ -1529,48 +1529,6 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.secret_scanning_repo_admin_settings_policy_update",
|
||||
"description": "N/A",
|
||||
@@ -4326,7 +4284,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -4347,7 +4305,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -4369,7 +4327,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -7930,52 +7888,6 @@
|
||||
],
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org.security_center_export_code_scanning_metrics",
|
||||
"description": "A CSV export was requested on the CodeQL pull request alerts page.",
|
||||
@@ -13509,6 +13421,334 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.auto_dismiss",
|
||||
"description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
|
||||
"docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"alert_id",
|
||||
"alert_number",
|
||||
"ghsa_id",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"request_access_security_header"
|
||||
],
|
||||
"docs_reference_titles": "About Dependabot auto-triage rules"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.auto_reopen",
|
||||
"description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
|
||||
"docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"alert_id",
|
||||
"alert_number",
|
||||
"ghsa_id",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"request_access_security_header"
|
||||
],
|
||||
"docs_reference_titles": "About Dependabot auto-triage rules"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.create",
|
||||
"description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
|
||||
"docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
|
||||
"fields": [
|
||||
"operation_type",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"@timestamp",
|
||||
"user_agent",
|
||||
"alert_id",
|
||||
"action",
|
||||
"repo",
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"alert_number",
|
||||
"programmatic_access_type"
|
||||
],
|
||||
"docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.dismiss",
|
||||
"description": "A Dependabot alert was manually dismissed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"repo_id",
|
||||
"org_id",
|
||||
"user_id",
|
||||
"request_id",
|
||||
"@timestamp",
|
||||
"operation_type",
|
||||
"user_agent",
|
||||
"alert_id",
|
||||
"actor",
|
||||
"repo",
|
||||
"created_at",
|
||||
"org",
|
||||
"_document_id",
|
||||
"action",
|
||||
"actor_id",
|
||||
"dismiss_reason",
|
||||
"user",
|
||||
"dismiss_comment",
|
||||
"alert_number",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.reintroduce",
|
||||
"description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"actor",
|
||||
"actor_id",
|
||||
"alert_id",
|
||||
"created_at",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"operation_type",
|
||||
"token_scopes",
|
||||
"alert_number"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.reopen",
|
||||
"description": "A Dependabot alert was manually reopened.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"actor",
|
||||
"actor_id",
|
||||
"alert_id",
|
||||
"created_at",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"public_repo",
|
||||
"alert_number",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.resolve",
|
||||
"description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"alert_id",
|
||||
"repo",
|
||||
"operation_type",
|
||||
"action",
|
||||
"repo_id",
|
||||
"_document_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"actor",
|
||||
"actor_id",
|
||||
"token_scopes",
|
||||
"alert_number",
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.withdraw",
|
||||
"description": "A Dependabot alert was withdrawn.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"alert_id",
|
||||
"alert_number",
|
||||
"ghsa_id",
|
||||
"created_at",
|
||||
"active",
|
||||
"action",
|
||||
"repository_id",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts.authorized_users_teams",
|
||||
"description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
|
||||
"fields": [
|
||||
"org",
|
||||
"_document_id",
|
||||
"repo",
|
||||
"org_id",
|
||||
"operation_type",
|
||||
"created_at",
|
||||
"actor",
|
||||
"action",
|
||||
"@timestamp",
|
||||
"user_agent",
|
||||
"repo_id",
|
||||
"request_id",
|
||||
"actor_id",
|
||||
"request_access_security_header"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts_auto_dismissal.disable",
|
||||
"description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts_auto_dismissal.enable",
|
||||
"description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts.disable",
|
||||
"description": "Dependabot alerts was disabled.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"repo",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"action",
|
||||
"actor_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"actor",
|
||||
"user_agent",
|
||||
"org_id",
|
||||
"user",
|
||||
"org",
|
||||
"_document_id",
|
||||
"user_id",
|
||||
"operation_type",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts.enable",
|
||||
"description": "Dependabot alerts was enabled.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"user_agent",
|
||||
"created_at",
|
||||
"@timestamp",
|
||||
"repo_id",
|
||||
"action",
|
||||
"user",
|
||||
"repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"actor_id",
|
||||
"_document_id",
|
||||
"user_id",
|
||||
"operation_type",
|
||||
"request_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "restrict_notification_delivery.disable",
|
||||
"description": "Email notification restrictions for an organization or enterprise were disabled.",
|
||||
@@ -14679,6 +14919,102 @@
|
||||
"_document_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "successor_invitation.accept",
|
||||
"description": "Triggered when you accept a succession invitation.",
|
||||
@@ -14799,7 +15135,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -14865,7 +15202,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -14888,7 +15226,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -14931,7 +15270,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -15039,7 +15379,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -15084,7 +15425,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -16758,6 +17100,150 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.create",
|
||||
"description": "A Dependabot rule was created.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.delete",
|
||||
"description": "A Dependabot rule was deleted.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.disable",
|
||||
"description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.enable",
|
||||
"description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.force_disable",
|
||||
"description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.force_enable",
|
||||
"description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.update",
|
||||
"description": "A Dependabot rule's conditions, actions, or metadata changed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "workflows.approve_workflow_job",
|
||||
"description": "A workflow job was approved.",
|
||||
|
||||
@@ -2203,7 +2203,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -2224,7 +2224,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -2246,7 +2246,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -5725,7 +5725,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -5788,7 +5789,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -7000,27 +7002,6 @@
|
||||
],
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org.security_center_export_code_scanning_metrics",
|
||||
"description": "A CSV export was requested on the CodeQL pull request alerts page.",
|
||||
@@ -15179,6 +15160,102 @@
|
||||
"_document_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.add_member",
|
||||
"description": "A member of an organization was added to a team.",
|
||||
@@ -15198,7 +15275,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -15264,7 +15342,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -15287,7 +15366,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -15330,7 +15410,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -15501,7 +15582,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -15546,7 +15628,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -6750,6 +6750,102 @@
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "successor_invitation.accept",
|
||||
"description": "Triggered when you accept a succession invitation.",
|
||||
|
||||
@@ -1552,48 +1552,6 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.secret_scanning_repo_admin_settings_policy_update",
|
||||
"description": "N/A",
|
||||
@@ -4479,7 +4437,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -4500,7 +4458,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -4522,7 +4480,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -8174,52 +8132,6 @@
|
||||
],
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org.security_center_export_code_scanning_metrics",
|
||||
"description": "A CSV export was requested on the CodeQL pull request alerts page.",
|
||||
@@ -13927,6 +13839,334 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.auto_dismiss",
|
||||
"description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
|
||||
"docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"alert_id",
|
||||
"alert_number",
|
||||
"ghsa_id",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"request_access_security_header"
|
||||
],
|
||||
"docs_reference_titles": "About Dependabot auto-triage rules"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.auto_reopen",
|
||||
"description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
|
||||
"docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"alert_id",
|
||||
"alert_number",
|
||||
"ghsa_id",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"request_access_security_header"
|
||||
],
|
||||
"docs_reference_titles": "About Dependabot auto-triage rules"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.create",
|
||||
"description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
|
||||
"docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
|
||||
"fields": [
|
||||
"operation_type",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"@timestamp",
|
||||
"user_agent",
|
||||
"alert_id",
|
||||
"action",
|
||||
"repo",
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"alert_number",
|
||||
"programmatic_access_type"
|
||||
],
|
||||
"docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.dismiss",
|
||||
"description": "A Dependabot alert was manually dismissed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"repo_id",
|
||||
"org_id",
|
||||
"user_id",
|
||||
"request_id",
|
||||
"@timestamp",
|
||||
"operation_type",
|
||||
"user_agent",
|
||||
"alert_id",
|
||||
"actor",
|
||||
"repo",
|
||||
"created_at",
|
||||
"org",
|
||||
"_document_id",
|
||||
"action",
|
||||
"actor_id",
|
||||
"dismiss_reason",
|
||||
"user",
|
||||
"dismiss_comment",
|
||||
"alert_number",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.reintroduce",
|
||||
"description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"actor",
|
||||
"actor_id",
|
||||
"alert_id",
|
||||
"created_at",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"operation_type",
|
||||
"token_scopes",
|
||||
"alert_number"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.reopen",
|
||||
"description": "A Dependabot alert was manually reopened.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"actor",
|
||||
"actor_id",
|
||||
"alert_id",
|
||||
"created_at",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"public_repo",
|
||||
"alert_number",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.resolve",
|
||||
"description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"alert_id",
|
||||
"repo",
|
||||
"operation_type",
|
||||
"action",
|
||||
"repo_id",
|
||||
"_document_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"actor",
|
||||
"actor_id",
|
||||
"token_scopes",
|
||||
"alert_number",
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.withdraw",
|
||||
"description": "A Dependabot alert was withdrawn.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"alert_id",
|
||||
"alert_number",
|
||||
"ghsa_id",
|
||||
"created_at",
|
||||
"active",
|
||||
"action",
|
||||
"repository_id",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts.authorized_users_teams",
|
||||
"description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
|
||||
"fields": [
|
||||
"org",
|
||||
"_document_id",
|
||||
"repo",
|
||||
"org_id",
|
||||
"operation_type",
|
||||
"created_at",
|
||||
"actor",
|
||||
"action",
|
||||
"@timestamp",
|
||||
"user_agent",
|
||||
"repo_id",
|
||||
"request_id",
|
||||
"actor_id",
|
||||
"request_access_security_header"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts_auto_dismissal.disable",
|
||||
"description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts_auto_dismissal.enable",
|
||||
"description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts.disable",
|
||||
"description": "Dependabot alerts was disabled.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"repo",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"action",
|
||||
"actor_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"actor",
|
||||
"user_agent",
|
||||
"org_id",
|
||||
"user",
|
||||
"org",
|
||||
"_document_id",
|
||||
"user_id",
|
||||
"operation_type",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts.enable",
|
||||
"description": "Dependabot alerts was enabled.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"user_agent",
|
||||
"created_at",
|
||||
"@timestamp",
|
||||
"repo_id",
|
||||
"action",
|
||||
"user",
|
||||
"repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"actor_id",
|
||||
"_document_id",
|
||||
"user_id",
|
||||
"operation_type",
|
||||
"request_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "restrict_notification_delivery.disable",
|
||||
"description": "Email notification restrictions for an organization or enterprise were disabled.",
|
||||
@@ -15126,6 +15366,102 @@
|
||||
"_document_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "successor_invitation.accept",
|
||||
"description": "Triggered when you accept a succession invitation.",
|
||||
@@ -15246,7 +15582,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -15312,7 +15649,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -15335,7 +15673,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -15378,7 +15717,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -15486,7 +15826,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -15531,7 +15872,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -17205,6 +17547,150 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.create",
|
||||
"description": "A Dependabot rule was created.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.delete",
|
||||
"description": "A Dependabot rule was deleted.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.disable",
|
||||
"description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.enable",
|
||||
"description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.force_disable",
|
||||
"description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.force_enable",
|
||||
"description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.update",
|
||||
"description": "A Dependabot rule's conditions, actions, or metadata changed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "workflows.approve_workflow_job",
|
||||
"description": "A workflow job was approved.",
|
||||
|
||||
@@ -2369,7 +2369,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -2390,7 +2390,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -2412,7 +2412,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -5915,7 +5915,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -5978,7 +5979,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -7190,27 +7192,6 @@
|
||||
],
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org.security_center_export_code_scanning_metrics",
|
||||
"description": "A CSV export was requested on the CodeQL pull request alerts page.",
|
||||
@@ -15594,6 +15575,102 @@
|
||||
"_document_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.add_member",
|
||||
"description": "A member of an organization was added to a team.",
|
||||
@@ -15613,7 +15690,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -15679,7 +15757,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -15702,7 +15781,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -15745,7 +15825,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -15916,7 +15997,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -15961,7 +16043,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -6813,6 +6813,102 @@
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "successor_invitation.accept",
|
||||
"description": "Triggered when you accept a succession invitation.",
|
||||
|
||||
@@ -1552,48 +1552,6 @@
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your enterprise.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "business.secret_scanning_repo_admin_settings_policy_update",
|
||||
"description": "N/A",
|
||||
@@ -4528,7 +4486,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -4549,7 +4507,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -4571,7 +4529,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -8223,52 +8181,6 @@
|
||||
],
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.push_protection_setting_changed",
|
||||
"description": "The push protection setting was changed for a secret type for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"secret_type",
|
||||
"secret_type_display_name",
|
||||
"push_protection_setting"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org.security_center_export_code_scanning_metrics",
|
||||
"description": "A CSV export was requested on the CodeQL pull request alerts page.",
|
||||
@@ -14030,6 +13942,334 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.auto_dismiss",
|
||||
"description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
|
||||
"docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"alert_id",
|
||||
"alert_number",
|
||||
"ghsa_id",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"request_access_security_header"
|
||||
],
|
||||
"docs_reference_titles": "About Dependabot auto-triage rules"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.auto_reopen",
|
||||
"description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
|
||||
"docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"alert_id",
|
||||
"alert_number",
|
||||
"ghsa_id",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"request_access_security_header"
|
||||
],
|
||||
"docs_reference_titles": "About Dependabot auto-triage rules"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.create",
|
||||
"description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
|
||||
"docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
|
||||
"fields": [
|
||||
"operation_type",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"@timestamp",
|
||||
"user_agent",
|
||||
"alert_id",
|
||||
"action",
|
||||
"repo",
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"alert_number",
|
||||
"programmatic_access_type"
|
||||
],
|
||||
"docs_reference_titles": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.dismiss",
|
||||
"description": "A Dependabot alert was manually dismissed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"repo_id",
|
||||
"org_id",
|
||||
"user_id",
|
||||
"request_id",
|
||||
"@timestamp",
|
||||
"operation_type",
|
||||
"user_agent",
|
||||
"alert_id",
|
||||
"actor",
|
||||
"repo",
|
||||
"created_at",
|
||||
"org",
|
||||
"_document_id",
|
||||
"action",
|
||||
"actor_id",
|
||||
"dismiss_reason",
|
||||
"user",
|
||||
"dismiss_comment",
|
||||
"alert_number",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.reintroduce",
|
||||
"description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"actor",
|
||||
"actor_id",
|
||||
"alert_id",
|
||||
"created_at",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"operation_type",
|
||||
"token_scopes",
|
||||
"alert_number"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.reopen",
|
||||
"description": "A Dependabot alert was manually reopened.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"actor",
|
||||
"actor_id",
|
||||
"alert_id",
|
||||
"created_at",
|
||||
"action",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"public_repo",
|
||||
"alert_number",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.resolve",
|
||||
"description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"alert_id",
|
||||
"repo",
|
||||
"operation_type",
|
||||
"action",
|
||||
"repo_id",
|
||||
"_document_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"actor",
|
||||
"actor_id",
|
||||
"token_scopes",
|
||||
"alert_number",
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alert.withdraw",
|
||||
"description": "A Dependabot alert was withdrawn.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"alert_id",
|
||||
"alert_number",
|
||||
"ghsa_id",
|
||||
"created_at",
|
||||
"active",
|
||||
"action",
|
||||
"repository_id",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"owner",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts.authorized_users_teams",
|
||||
"description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
|
||||
"docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
|
||||
"fields": [
|
||||
"org",
|
||||
"_document_id",
|
||||
"repo",
|
||||
"org_id",
|
||||
"operation_type",
|
||||
"created_at",
|
||||
"actor",
|
||||
"action",
|
||||
"@timestamp",
|
||||
"user_agent",
|
||||
"repo_id",
|
||||
"request_id",
|
||||
"actor_id",
|
||||
"request_access_security_header"
|
||||
],
|
||||
"docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts_auto_dismissal.disable",
|
||||
"description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts_auto_dismissal.enable",
|
||||
"description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts.disable",
|
||||
"description": "Dependabot alerts was disabled.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"repo",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"action",
|
||||
"actor_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"actor",
|
||||
"user_agent",
|
||||
"org_id",
|
||||
"user",
|
||||
"org",
|
||||
"_document_id",
|
||||
"user_id",
|
||||
"operation_type",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "repository_vulnerability_alerts.enable",
|
||||
"description": "Dependabot alerts was enabled.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"user_agent",
|
||||
"created_at",
|
||||
"@timestamp",
|
||||
"repo_id",
|
||||
"action",
|
||||
"user",
|
||||
"repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"actor_id",
|
||||
"_document_id",
|
||||
"user_id",
|
||||
"operation_type",
|
||||
"request_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type",
|
||||
"actor_is_bot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "restrict_notification_delivery.disable",
|
||||
"description": "Email notification restrictions for an organization or enterprise were disabled.",
|
||||
@@ -15229,6 +15469,102 @@
|
||||
"_document_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "successor_invitation.accept",
|
||||
"description": "Triggered when you accept a succession invitation.",
|
||||
@@ -15349,7 +15685,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -15415,7 +15752,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -15438,7 +15776,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -15481,7 +15820,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -15589,7 +15929,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -15634,7 +15975,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -17308,6 +17650,150 @@
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.create",
|
||||
"description": "A Dependabot rule was created.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.delete",
|
||||
"description": "A Dependabot rule was deleted.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.disable",
|
||||
"description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.enable",
|
||||
"description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.force_disable",
|
||||
"description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.force_enable",
|
||||
"description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"org",
|
||||
"org_id",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "vulnerability_alert_rule.update",
|
||||
"description": "A Dependabot rule's conditions, actions, or metadata changed.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"repo_id",
|
||||
"vulnerability_alert_rule_id",
|
||||
"vulnerability_alert_rule_name",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "workflows.approve_workflow_job",
|
||||
"description": "A workflow job was approved.",
|
||||
|
||||
@@ -2418,7 +2418,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.clone",
|
||||
"description": "A repository was cloned.",
|
||||
"description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -2439,7 +2439,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.fetch",
|
||||
"description": "Changes were fetched from a repository.",
|
||||
"description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"action",
|
||||
@@ -2461,7 +2461,7 @@
|
||||
},
|
||||
{
|
||||
"action": "git.push",
|
||||
"description": "Changes were pushed to a repository.",
|
||||
"description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"transport_protocol",
|
||||
@@ -6083,7 +6083,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -6146,7 +6147,8 @@
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"business",
|
||||
"business_id"
|
||||
"business_id",
|
||||
"oauth_application_name"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -7381,27 +7383,6 @@
|
||||
],
|
||||
"docs_reference_titles": "About push protection"
|
||||
},
|
||||
{
|
||||
"action": "org_secret_scanning_push_protection_pattern_configuration.updated",
|
||||
"description": "The push protection pattern configuration was updated for your org.",
|
||||
"docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"user",
|
||||
"user_id",
|
||||
"org",
|
||||
"org_id",
|
||||
"business",
|
||||
"business_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp"
|
||||
],
|
||||
"docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
|
||||
},
|
||||
{
|
||||
"action": "org.security_center_export_code_scanning_metrics",
|
||||
"description": "A CSV export was requested on the CodeQL pull request alerts page.",
|
||||
@@ -15893,6 +15874,102 @@
|
||||
"_document_id"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "team.add_member",
|
||||
"description": "A member of an organization was added to a team.",
|
||||
@@ -15912,7 +15989,8 @@
|
||||
"org",
|
||||
"action",
|
||||
"actor",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
|
||||
},
|
||||
@@ -15978,7 +16056,8 @@
|
||||
"org_id",
|
||||
"@timestamp",
|
||||
"actor",
|
||||
"_document_id"
|
||||
"_document_id",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
|
||||
},
|
||||
@@ -16001,7 +16080,8 @@
|
||||
"created_at",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -16044,7 +16124,8 @@
|
||||
"request_id",
|
||||
"operation_type",
|
||||
"_document_id",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -16215,7 +16296,8 @@
|
||||
"user_agent",
|
||||
"_document_id",
|
||||
"token_scopes",
|
||||
"programmatic_access_type"
|
||||
"programmatic_access_type",
|
||||
"team_type"
|
||||
],
|
||||
"docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
|
||||
},
|
||||
@@ -16260,7 +16342,8 @@
|
||||
"@timestamp",
|
||||
"_document_id",
|
||||
"programmatic_access_type",
|
||||
"request_access_security_header"
|
||||
"request_access_security_header",
|
||||
"team_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -6839,6 +6839,102 @@
|
||||
"operation_type"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_add",
|
||||
"description": "A parent issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.parent_issue_remove",
|
||||
"description": "A parent issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_add",
|
||||
"description": "A sub-issue was added to an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "sub_issues.sub_issue_remove",
|
||||
"description": "A sub-issue was removed from an issue.",
|
||||
"docs_reference_links": "N/A",
|
||||
"fields": [
|
||||
"actor",
|
||||
"actor_id",
|
||||
"user_agent",
|
||||
"request_id",
|
||||
"title",
|
||||
"repo",
|
||||
"repo_id",
|
||||
"public_repo",
|
||||
"org",
|
||||
"org_id",
|
||||
"action",
|
||||
"_document_id",
|
||||
"@timestamp",
|
||||
"created_at",
|
||||
"operation_type",
|
||||
"actor_is_bot",
|
||||
"request_access_security_header"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "successor_invitation.accept",
|
||||
"description": "Triggered when you accept a succession invitation.",
|
||||
|
||||
18852
src/audit-logs/data/ghes-3.19/enterprise.json
Normal file
18852
src/audit-logs/data/ghes-3.19/enterprise.json
Normal file
File diff suppressed because it is too large
Load Diff
17575
src/audit-logs/data/ghes-3.19/organization.json
Normal file
17575
src/audit-logs/data/ghes-3.19/organization.json
Normal file
File diff suppressed because it is too large
Load Diff
9055
src/audit-logs/data/ghes-3.19/user.json
Normal file
9055
src/audit-logs/data/ghes-3.19/user.json
Normal file
File diff suppressed because it is too large
Load Diff
@@ -9,5 +9,5 @@
|
||||
"git": "Note: Git events have special access requirements and retention policies that differ from other audit log events. For GitHub Enterprise Cloud, access Git events via the REST API only with 7-day retention. For GitHub Enterprise Server, Git events must be enabled in audit log configuration and are not included in search results.",
|
||||
"sso_redirect": "Note: Automatically redirecting users to sign in is currently in beta for Enterprise Managed Users and subject to change."
|
||||
},
|
||||
"sha": "1fd7e8dc57f677be202bb6e7024a2ec4b16fd469"
|
||||
"sha": "200887873e2afa17d119188c6b42b0b04248a862"
|
||||
}
|
||||
Reference in New Issue
Block a user