GitHub audit log
GitHub audit log. Organization or enterprise audit event export.
Source and collection
Product audit API or configured diagnostic export.
Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — line 1
One complete record selected; values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: 5a2c8c7dba45fc665bf5233a50bad84800b74b9d48c0f57233d4d66efc43e86a
{"@timestamp":1741611465102,"_document_id":"Zt3XoecTsz6kAS-87bAEzQ","action":"api.request","actor":"user_actor","actor_id":11111,"actor_is_bot":false,"actor_location":{"country_code":"IN"},"business":"enterprise-account","business_id":222222,"created_at":1741611465102,"hashed_token":"E8Fzcgs3TQXqhrKKC/qNR+2XZnaK3ykQBSAt1kPMiJs=","org":"user-delete","org_id":3333333,"request_category":"api","request_method":"GET","route":"/repos/{owner}/{repo}/pulls","status_code":200,"token_id":555555,"token_scopes":"repo,read:org","user_agent":"curl/7.79.1"}
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
@timestamp | int |
_document_id | str |
action | str |
actor | str |
actor_id | int |
actor_is_bot | bool |
actor_location.country_code | str |
business | str |
business_id | int |
created_at | int |
hashed_token | str |
org | str |
org_id | int |
request_category | str |
request_method | str |
route | str |
status_code | int |
token_id | int |
token_scopes | str |
user_agent | str |
- Event identity
- Use the source event ID and tenant scope to deduplicate.
- Event type
- Select the schema for this category/action.
- Timestamp
- Retain both event and ingestion time where available.
Investigation uses
- Review action, actor, token context and organization scope.
- Compare actor and target context with approved changes and other authentication evidence.
Validation boundaries
Availability and retention depend on product and export; field sets vary by action.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.