|
| 1 | +--- |
| 2 | +title: Reviewing audit logs for GitHub Copilot |
| 3 | +shortTitle: Review audit logs |
| 4 | +intro: Check for changes to settings or licenses in your {% data variables.product.prodname_copilot_short %} plan. |
| 5 | +product: '{% data variables.copilot.copilot_business_short %} or {% data variables.copilot.copilot_enterprise_short %}' |
| 6 | +permissions: Enterprise owners or users with the "Read enterprise audit logs" custom role |
| 7 | +redirect_from: |
| 8 | + - /copilot/managing-copilot-for-business/reviewing-your-organization-or-enterprises-audit-logs-for-copilot-for-business |
| 9 | + - /copilot/managing-copilot-business/reviewing-your-organization-or-enterprises-audit-logs-for-copilot-business |
| 10 | + - /copilot/managing-github-copilot-in-your-organization/reviewing-your-organization-or-enterprises-audit-logs-for-copilot-business |
| 11 | + - /copilot/managing-github-copilot-in-your-organization/reviewing-audit-logs-for-copilot-business |
| 12 | + - /copilot/managing-copilot/managing-github-copilot-in-your-organization/reviewing-audit-logs-for-copilot-business |
| 13 | + - /copilot/managing-copilot/managing-github-copilot-in-your-organization/reviewing-github-copilot-activity-in-your-organization/reviewing-audit-logs-for-copilot-business |
| 14 | + - /copilot/managing-copilot/managing-github-copilot-in-your-organization/managing-access-to-github-copilot-in-your-organization/reviewing-audit-logs-for-copilot-business |
| 15 | + - /copilot/managing-copilot/managing-github-copilot-in-your-organization/reviewing-activity-related-to-github-copilot-in-your-organization/reviewing-audit-logs-for-copilot-business |
| 16 | + - /copilot/how-tos/administer/organizations/reviewing-activity-related-to-github-copilot-in-your-organization/reviewing-audit-logs-for-copilot-business |
| 17 | + - /copilot/how-tos/administer/organizations/reviewing-activity-related-to-github-copilot-in-your-organization/review-audit-logs |
| 18 | + - /copilot/how-tos/administer/organizations/review-activity/review-audit-logs |
| 19 | + - /copilot/how-tos/administer/manage-for-organization/review-activity/review-audit-logs |
| 20 | + - /copilot/how-tos/administer-copilot/manage-for-organization/review-activity/review-audit-logs |
| 21 | +versions: |
| 22 | + feature: copilot |
| 23 | +contentType: how-tos |
| 24 | +category: |
| 25 | + - Manage Copilot for a team |
| 26 | +--- |
| 27 | + |
| 28 | +You can use the audit log to review actions taken in your enterprise. The audit log includes a record of: |
| 29 | + |
| 30 | +* Changes to your {% data variables.product.prodname_copilot_short %} plan, such as changes to settings and policies or a user losing or receiving a license |
| 31 | +* Agent activity on the {% data variables.product.github %} website |
| 32 | + |
| 33 | +The audit log does **not** include client session data, such as the prompts a user sends to {% data variables.product.prodname_copilot_short %} locally. A custom solution is required to access this data: for example, some companies use custom hooks to send {% data variables.copilot.copilot_cli_short %} events to their own logging service. |
| 34 | + |
| 35 | +## Viewing your enterprise's audit logs |
| 36 | + |
| 37 | +{% data reusables.enterprise-accounts.access-enterprise %} |
| 38 | +{% data reusables.enterprise-accounts.settings-tab %} |
| 39 | +{% data reusables.enterprise-accounts.audit-log-tab %} |
| 40 | + |
| 41 | +## Searching audit log events |
| 42 | + |
| 43 | +Use the `action:copilot` search term to view all events related to your {% data variables.product.prodname_copilot_short %} plan. |
| 44 | + |
| 45 | +You can also filter by a specific event. For example, `action:copilot.cfb_seat_assignment_created` returns events related to a license being assigned to a new user. For a full list of {% data variables.product.prodname_copilot_short %} events, see [AUTOTITLE](/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#copilot) or [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization#copilot). |
| 46 | + |
| 47 | +To view a record of agent activity, use the `actor:Copilot` search term. See [AUTOTITLE](/copilot/reference/agentic-audit-log-events). |
| 48 | + |
| 49 | +## Retaining audit log history |
| 50 | + |
| 51 | +The audit log retains events for the last 180 days. We recommend streaming the audit log to a Security Information and Event Management (SIEM) platform, where you can view long-term history and set up alerts for anomalous activity. See [AUTOTITLE](/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise). |
| 52 | + |
| 53 | +## Further reading |
| 54 | + |
| 55 | +* [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization) |
0 commit comments