Skip to content

Commit 69d3de5

Browse files
docs-botvgrl
andauthored
Update audit log event data (#62733)
Co-authored-by: Vanessa <vgrl@github.com>
1 parent f070359 commit 69d3de5

6 files changed

Lines changed: 505 additions & 26 deletions

File tree

src/audit-logs/data/ghes-3.22/enterprise.json

Lines changed: 147 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,40 @@
197197
"user_programmatic_access_name"
198198
]
199199
},
200+
{
201+
"action": "actions_policy.evaluate",
202+
"description": "N/A",
203+
"docs_reference_links": "N/A",
204+
"fields": [
205+
"@timestamp",
206+
"_document_id",
207+
"action",
208+
"actor",
209+
"actor_id",
210+
"business",
211+
"business_id",
212+
"hashed_token",
213+
"org",
214+
"org_id",
215+
"programmatic_access_type",
216+
"repo",
217+
"repo_id",
218+
"repository",
219+
"repository_id",
220+
"request_access_security_header",
221+
"request_id",
222+
"token_id",
223+
"token_scopes",
224+
"user",
225+
"user_id",
226+
"user_agent",
227+
"actor_is_agent",
228+
"actor_is_bot",
229+
"created_at",
230+
"operation_type",
231+
"public_repo"
232+
]
233+
},
200234
{
201235
"action": "api.request",
202236
"description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
@@ -1493,6 +1527,40 @@
14931527
"operation_type"
14941528
]
14951529
},
1530+
{
1531+
"action": "business.code_scanning_ai_findings_policy_update",
1532+
"description": "The policy for Code scanning AI findings was updated for an enterprise.",
1533+
"docs_reference_links": "N/A",
1534+
"fields": [
1535+
"@timestamp",
1536+
"_document_id",
1537+
"action",
1538+
"actor",
1539+
"actor_id",
1540+
"business",
1541+
"business_id",
1542+
"hashed_token",
1543+
"org",
1544+
"org_id",
1545+
"programmatic_access_type",
1546+
"repo",
1547+
"repo_id",
1548+
"repository",
1549+
"repository_id",
1550+
"request_access_security_header",
1551+
"request_id",
1552+
"token_id",
1553+
"token_scopes",
1554+
"user",
1555+
"user_id",
1556+
"user_agent",
1557+
"actor_is_bot",
1558+
"created_at",
1559+
"name",
1560+
"new_policy",
1561+
"operation_type"
1562+
]
1563+
},
14961564
{
14971565
"action": "business.code_scanning_autofix_policy_update",
14981566
"description": "The policy for Code scanning autofix was updated for an enterprise.",
@@ -4778,7 +4846,8 @@
47784846
"created_at",
47794847
"operation_type",
47804848
"owner",
4781-
"owner_type"
4849+
"owner_type",
4850+
"user_programmatic_access_name"
47824851
]
47834852
},
47844853
{
@@ -4888,6 +4957,40 @@
48884957
"seat_assignment"
48894958
]
48904959
},
4960+
{
4961+
"action": "copilot.code_review_repository_settings_updated",
4962+
"description": "Copilot code review settings were updated for a repository.",
4963+
"docs_reference_links": "N/A",
4964+
"fields": [
4965+
"@timestamp",
4966+
"_document_id",
4967+
"action",
4968+
"actor",
4969+
"actor_id",
4970+
"business",
4971+
"business_id",
4972+
"hashed_token",
4973+
"org",
4974+
"org_id",
4975+
"programmatic_access_type",
4976+
"repo",
4977+
"repo_id",
4978+
"repository",
4979+
"repository_id",
4980+
"request_access_security_header",
4981+
"request_id",
4982+
"token_id",
4983+
"token_scopes",
4984+
"user",
4985+
"user_id",
4986+
"user_agent",
4987+
"actor_is_bot",
4988+
"created_at",
4989+
"old_settings",
4990+
"operation_type",
4991+
"public_repo"
4992+
]
4993+
},
48914994
{
48924995
"action": "copilot.swe_agent_firewall_allowlist_updated",
48934996
"description": "Firewall allowlist for Copilot coding agent was updated for an organization.",
@@ -10700,6 +10803,39 @@
1070010803
"old_allowlist_name"
1070110804
]
1070210805
},
10806+
{
10807+
"action": "mcp_registry.settings_update",
10808+
"description": "An MCP policy setting for the business was updated.",
10809+
"docs_reference_links": "N/A",
10810+
"fields": [
10811+
"@timestamp",
10812+
"_document_id",
10813+
"action",
10814+
"actor",
10815+
"actor_id",
10816+
"business",
10817+
"business_id",
10818+
"hashed_token",
10819+
"org",
10820+
"org_id",
10821+
"programmatic_access_type",
10822+
"repo",
10823+
"repo_id",
10824+
"repository",
10825+
"repository_id",
10826+
"request_access_security_header",
10827+
"request_id",
10828+
"token_id",
10829+
"token_scopes",
10830+
"user",
10831+
"user_id",
10832+
"user_agent",
10833+
"block_local_servers",
10834+
"mcp_policy",
10835+
"old_block_local_servers",
10836+
"old_mcp_policy"
10837+
]
10838+
},
1070310839
{
1070410840
"action": "merge_queue.pull_request_dequeued",
1070510841
"description": "A pull request was removed from a merge queue.",
@@ -19272,7 +19408,7 @@
1927219408
"topic",
1927319409
"user_programmatic_access_name"
1927419410
],
19275-
"docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
19411+
"docs_reference_titles": "Closing a pull request"
1927619412
},
1927719413
{
1927819414
"action": "pull_request.converted_to_draft",
@@ -19312,7 +19448,7 @@
1931219448
"pull_request_url",
1931319449
"user_programmatic_access_name"
1931419450
],
19315-
"docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
19451+
"docs_reference_titles": "Changing the stage of a pull request"
1931619452
},
1931719453
{
1931819454
"action": "pull_request.create",
@@ -19353,7 +19489,7 @@
1935319489
"pull_request_url",
1935419490
"user_programmatic_access_name"
1935519491
],
19356-
"docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request"
19492+
"docs_reference_titles": "Creating a pull request"
1935719493
},
1935819494
{
1935919495
"action": "pull_request.create_review_request",
@@ -19397,7 +19533,7 @@
1939719533
"topic",
1939819534
"user_programmatic_access_name"
1939919535
],
19400-
"docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
19536+
"docs_reference_titles": "Pull request reviews"
1940119537
},
1940219538
{
1940319539
"action": "pull_request.in_progress",
@@ -19510,7 +19646,7 @@
1951019646
"topic",
1951119647
"user_programmatic_access_name"
1951219648
],
19513-
"docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
19649+
"docs_reference_titles": "Merging a pull request"
1951419650
},
1951519651
{
1951619652
"action": "pull_request.ready_for_review",
@@ -19550,7 +19686,7 @@
1955019686
"pull_request_url",
1955119687
"user_programmatic_access_name"
1955219688
],
19553-
"docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
19689+
"docs_reference_titles": "Changing the stage of a pull request"
1955419690
},
1955519691
{
1955619692
"action": "pull_request.rebase",
@@ -19633,7 +19769,7 @@
1963319769
"topic",
1963419770
"user_programmatic_access_name"
1963519771
],
19636-
"docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
19772+
"docs_reference_titles": "Pull request reviews"
1963719773
},
1963819774
{
1963919775
"action": "pull_request.reopen",
@@ -19710,7 +19846,7 @@
1971019846
"topic",
1971119847
"user_programmatic_access_name"
1971219848
],
19713-
"docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
19849+
"docs_reference_titles": "Pull request reviews"
1971419850
},
1971519851
{
1971619852
"action": "pull_request_review_comment.delete",
@@ -19866,7 +20002,7 @@
1986620002
"topic",
1986720003
"user_programmatic_access_name"
1986820004
],
19869-
"docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
20005+
"docs_reference_titles": "Dismissing a pull request review"
1987020006
},
1987120007
{
1987220008
"action": "pull_request_review.submit",
@@ -19908,7 +20044,7 @@
1990820044
"topic",
1990920045
"user_programmatic_access_name"
1991020046
],
19911-
"docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
20047+
"docs_reference_titles": "Reviewing proposed changes in a pull request"
1991220048
},
1991320049
{
1991420050
"action": "repo.access",

0 commit comments

Comments
 (0)